Privacy Policy
What ChinaMedMap collects, why, who sees it, how long we keep it and how to have it deleted.
General inquiry consent version: 2026-09-21. Registered patient inquiry consent version: 2026-10-06.
Summary
- We collect personal information when you create a patient account, send an inquiry or contact us.
- Your inquiry may include health information. We treat it as sensitive, restrict who can see it, and share it with a provider only after you agree.
- We use the medical information you give us only to find suitable hospitals and doctors for you. If a hospital needs reports or images, we agree with you how to send them.
- What you type into search, and what you write in forms, is never sent to analytics or advertising tools.
What we collect
Inquiry form. Name, email, country, a broad category for your medical need and a description of your medical needs. Optionally: phone or WhatsApp number, treatment interest, preferred city and timing. We also record the page you came from, the provider profile you were viewing if any, the date and time, the version of this policy you consented to, and a one-way hash of your IP address used only to limit abuse.
Patient accounts and direct clinic enquiries. We use Supabase for email authentication and access-controlled account and inquiry storage. Our current project is hosted in South Korea. Registered enquiries include your verified email, name, chosen recipient (a clinic or the ChinaMedMap assistance team) and service, request text, international phone number, consent date/version and follow-up status. Authorised ChinaMedMap operators can manage your enquiry. For a direct clinic request, that clinic’s authorised staff can also read it and contact you; their internal follow-up notes are not shown in your patient account. We do not send your enquiry text to AI writing or translation services. Your account can also store your name, international phone number, country or region and preferred language for future enquiries. You can update these details in your patient account. We use Resend to deliver account verification and password reset emails, and Cloudflare Turnstile to help prevent automated registrations.
Enquiry conversations. Messages and attachments you send through your account are shared with the recipient of that enquiry and authorised ChinaMedMap operators. We use our hosted Chatwoot service to manage these conversations. Where available, your account can show the public messages and email replies associated with your own enquiry; internal staff notes are not included. Unsent message drafts and selected attachment files stay only in the open page and are cleared when you sign out or reload. Please do not include detailed medical records, passport details or payment information.
Analytics. If analytics is enabled, we record page views and a small, fixed set of events (for example “inquiry form submitted”) with non-sensitive parameters such as page type and an internal provider ID. We do not record search text, form contents, or health information, and we do not use advertising pixels or session-replay tools. We also use Ahrefs Web Analytics, which does not set cookies. According to Ahrefs, it records page addresses, the referring site, browser and device type, country and city (IP addresses are discarded), language settings, and interactions such as page views, link clicks and form submissions.
Maps. Hospital profiles offer an optional map from Google Maps. Nothing is requested from Google until you choose “Show map”; from that point Google receives your request and may set cookies under Google’s own privacy policy. Visitors in mainland China are shown address links instead of the map.
Cookies and browser storage. Public information pages can be browsed without an account. Patient sign-in uses browser storage for the authentication session; we also retain the selected clinic and enquiry type in session storage so you can return after verification. Patient account, hospital inquiry and assistance form pages do not load our analytics scripts. Unsubmitted contact details and request text stay only in the open page, not in persistent browser storage; closing or reloading the page discards them. Google Analytics, if enabled, may set cookies; so may a map you have chosen to show. Ahrefs Web Analytics does not set cookies.
Why we use it, and our basis for doing so
We use inquiry information to understand your request, reply to you, and — with your explicit consent — introduce you to providers that may be able to help. You give consent on the form and can withdraw it at any time by contacting us.
Who sees it
- ChinaMedMap staff who handle inquiries, on a need-to-know basis.
- Providers you have agreed we may contact on your behalf. Providers are usually in mainland China, so your information will be transferred there. We tell you which provider before we share anything.
- Service providers that host our website and database, under contract.
We do not sell personal information.
How long we keep it
We keep inquiry records for as long as needed to handle your request, and then delete or anonymise them within 24 months of our last contact with you, unless the law requires otherwise. Abuse-prevention hashes are deleted within 30 days.
Your rights
You can ask us for a copy of your information, to correct it, to delete it, or to stop using it. Depending on where you live, you may have further rights under laws such as the GDPR, UK GDPR or China’s Personal Information Protection Law, including the right to complain to a regulator. Use the contact page and we will respond within 30 days.
Security
Inquiries are sent over HTTPS and stored in an access-controlled database. Health details are never placed in URLs or email subject lines. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires.
Children
The site is not directed at children. A parent or guardian should submit inquiries on behalf of a child.
Changes
We will update this page and its version date when our practices change.